Executive brief
A vulnerability in the Linux kernel's PowerPC pSeries platform support could allow a local user to view sensitive information from the system's memory. This occurs because certain internal data structures were not properly cleared before being sent to user-accessible areas. While this does not allow an attacker to crash the system or take control, it could potentially expose private data belonging to the operating system or other users.
Technical details
An information leak exists in the pseries/papr-hvpipe implementation within the Linux kernel. The 'papr_hvpipe_handle_read' function allocates a 'papr_hvpipe_hdr' structure on the stack but only initializes specific fields, leaving reserved padding bytes uninitialized. When this structure is subsequently copied to userspace via 'copy_to_user()', these uninitialized padding bytes can leak sensitive kernel stack memory to a local attacker. The fix involves zero-initializing the entire structure at the time of allocation. This issue primarily affects PowerPC architectures utilizing PAPR hypervisor pipes.
Affected products
- Linux Linux Kernel PowerPC pSeries platforms
Timeline
- 2026-05-01: other: Patch authored
- 2026-05-28: disclosed: CVE published